The unique ID generation in Apache::Session is actually not very good. It can have collisions, especially when used in a cluster of servers. You should replace that function with something better (I like mod_unique_id) if you use it in a cluster and are concerned about collisions.